Your rights and how we protect them
Deed Poll Office is committed to compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and the Data Protection Act 2018. We take every precaution to protect your information, and we take our responsibilities very seriously.
We follow the following principles when making decisions about the privacy and security of personal data:
- your personal information is only processed with your knowledge and consent (implicit or explicit)
- we only collect and process personal information that we actually need
- your personal information is only seen by those who need it to do their jobs
- your personal information is kept only for as long as it is needed
- your personal information should be accurate
- your personal information is only used for the purpose originally intended
- decisions affecting you are made on the basis of reliable and up-to-date personal information
- your personal information should be protected from corruption, tampering, misuse, loss, theft, and unauthorised or accidental disclosure
- there will be procedures in place for dealing promptly with any disputes
These principles apply equally whether we hold your personal information on paper or in electronic form.
What is defined as personal information?
Personal information means data which relate to a person who can be identified from the data. All the data we hold about you are personal information, as long as we are (or would be) able to identify you from that data. If, for example, we were to destroy the details of your name and address, then the rest of your data would no longer be personal information — it would become anonymous, because we wouldn’t be able to identify you from it.
The personal information we hold
We keep the personal data you give us in your deed poll application for 56 days after processing your application. This is so that we can:
- prepare your deed poll documentation
- provide you with information and advice about changing your name
- answer any queries or complaints you may have after receiving your deed poll documentation
- issue a corrected deed poll in the event that we or you make a mistake on the deed poll
- verify the authenticity of the deed poll if requested
We keep your e-mail address for 112 days after processing your application. The reason we keep your e‑mail address for longer than the rest of your data, is so that we can still verify that you have paid for our service if you need to contact us (after we’ve destroyed the rest of your personal data).
56 days after processing your application, we destroy all your personally identifying data (except your e‑mail address), both electronically and on paper. After 112 days we also destroy your e‑mail address. Altogther, the data we destroy are:
- your old name
- your new name
- your address(es)
- any other contact details we hold for you
Note that we are required by law to keep a copy of our invoices for 5 years. However after 5 years we destroy all copies of invoices (and credit notes) that we have issued. The invoices we generate show the name and address that you ask us to deliver your documents to. When making an application with us, you are welcome to fill in any name and address for this purpose — it does not have to match the name and address we put on the deed poll documents.
Thus the data we do hold permanently after 56 days is anonymous so far as the law allows us — the data we keep cannot be used to identify you personally.
Data we hold after 56 days
We do not keep any personal data 56 days after we have processed your application (except your e‑mail address which we keep for slightly longer). Any data we do keep after this point is anonymous — it would be practically impossible for us to relate it to the person it originally came from.
We do keep anonymous data for statistical purposes, such as the number of adult applications versus child applications, data about how our website is used, and technical data about the sorts of computers that access our site.
We store your IP address for the purposes of preventing fraud, theft of data, and misuse of our computer systems.
An IP address is like a telephone number that computers (and other devices) use to identify each other over the internet. It is not possible to identify an individual from their IP address alone — identifying someone personally would require information from their Internet Service Provider (ISP). The data that your ISP holds about you is also subject to the GDPR and the Data Protection Act. We would only attempt to obtain personal data from an ISP in the case of suspected fraud, data theft, or another criminal act taking place on our computer systems.
We store your IP address for longer than 56 days, but after 56 days we store it in such a way that it is not linked to any other data that came from your application. This means that even if we were to use your IP address to identify you, any of your application data that we keep will always stay anonymous.
Personal information we do not hold
We keep a record of how your application was paid for, whether by credit card, by cheque, etc. However, we do not at any point store any data relating to the payment itself, except where required to do so by normal accounting processes or by law. This includes:
- debit / credit card number, security code, account name, or expiry date
- billing address
- bank account name
Note that if you choose to pay online (that is, by debit / credit card), your payment is made through our payment provider (currently PayPal). This means that your payment details are passed directly to the payment provider — we do not process the data ourselves — which increases the all-round security of the transaction.
How we handle your personal information
We will use your personal information to prepare your deed poll documentation, and to provide you with information and advice about changing your name.
Your personal information will only be seen by those whose jobs require it. This applies both to Deed Poll Office staff who process deed poll applications and anyone else we work or deal with.
Personal information will be passed to certain data processors who work with Deed Poll Office. A data processor is anyone other than Deed Poll Office (and our staff) who we appoint to process personal data on our behalf. Data processors must also comply with the GDPR and the Data Protection Act.
We currently work with the following data processors:
- Royal Mail
- our partner for delivering deed poll documentation and other correspondence
- our partner for computer infrastructure and website hosting
Any member of staff that has access to your personal information will be thoroughly checked. All staff are aware of their duties under the GDPR and the Data Protection Act.
Your personal information will never be disclosed or sold to any third party, except for the purposes as described above, or where we are required to do so by law.
How we store your personal information
Our belief is that data stored electronically is inherently far less secure than data stored on paper. Our policy is to keep personal data electronically for as short a time as possible, and thereafter we prefer to store it on paper only.
We will keep all your personal data on our database until we have processed your application — which is normally within 2 working days of receiving it. After your application has been despatched, we delete all your personally identifying data from the database — that is — your names, addresses, and any other contact details we hold for you. At this point, the data held electronically becomes anonymous — the data cannot be used to identify you personally.
We keep your personal data (except your e‑mail address) on paper for 56 days after we have processed your application.
Our offices and our data servers are based in the E.U. Your personal data will not be transferred outside the E.U. without expressly seeking your permission, or unless you request that we deliver deed poll documentation outside the E.U., or you make correspondence with us from outside the E.U.
Your right to access your personal information
You have the right to know what personal information we hold about you, under the GDPR. If any details are wrong, you have the right to have it corrected.
If you would like a copy of your own information, you should write to us, either by post or by e‑mail. This is commonly called a subject access request. The request does not have to be in any prescribed form. You will have to pay a fee of £ 10, and we may ask you for information to prove your identity. Please make cheques payable to Deed Poll Office.
Note that in the case of a child, their personal information belongs to them. If the child is aged 12 years or more, we will normally require the child to make the subject access request, or at least to give their consent. For children under the age of 12, we may ask you to prove that you have parental responsibility for the child — especially if you were not the one that made a deed poll application for the child.
There are some specific cases where personal information is exempt from the right to access. For example, we can refuse requests where providing personal information would be likely to prejudice:
- the prevention or detection of crime
- the privacy rights of a third party